Cisco Catalyst SD‑WAN Flaws: Root Access Exploits in the Wild

Cisco has issued an urgent advisory warning of five vulnerabilities in Catalyst SD‑WAN Manager that could allow attackers to bypass authentication, gain root access, and overwrite critical files. Two of these flaws are already being exploited in real‑world attacks, making immediate patching essential.

Key Vulnerabilities

• CVE‑2026‑20129: Critical authentication bypass (CVSS 9.8).
  • Remote, unauthenticated attackers can send crafted API requests to instantly gain netadmin privileges.
• CVE‑2026‑20126: Local privilege escalation.
  • Low‑privileged users can escalate to root access on the OS.
• CVE‑2026‑20122: Exploited in the wild.
  • Attackers with read‑only credentials can overwrite arbitrary system files and gain vManage rights.
• CVE‑2026‑20128: Exploited in the wild.
  • Targets the Data Collection Agent (DCA), allowing low‑level users to steal plaintext passwords and spread access.
• CVE‑2026‑20127: Additional vulnerability with potential system impact.

Impact

• Active exploitation: CVE‑2026‑20122 and CVE‑2026‑20128 are being used in real attacks.
• Root compromise: Attackers can escalate privileges and overwrite critical files.
• Operational risk: Compromised SD‑WAN managers could enable lateral movement across enterprise networks.
• No workarounds: Cisco confirms there are no temporary mitigations — patching is the only defense.

Defensive Recommendations

• Patch immediately: Upgrade to fixed releases:
  • 20.9.8.2
  • 20.12.5.3
  • 20.18.2.1
• Upgrade path: Catalyst SD‑WAN Manager releases 20.18+ are immune to the critical flaws.
• Harden defenses:
  • Restrict internet access to the SD‑WAN Manager portal.
  • Disable unused services (HTTP, FTP).
  • Implement strict firewall rules.
• Monitor activity: Watch for suspicious API requests and privilege escalations.

Final Thought

These vulnerabilities highlight how network management platforms are high‑value targets. For leaders, the takeaway is clear: patching SD‑WAN systems is not optional — it’s urgent. Organizations must treat management portals as part of their attack surface and enforce strict access controls alongside rapid patch adoption.